On Jun 26, 2007, at 11:09 AM, Clinton Gormley wrote:
allowScriptAccess="never"
allownetworking="internal"
I don't know what those are :)
<object> tags are removed by default, and you would still need to
subclass HTML::StripScripts in order to allow those elements.
The Rules (for safety's sake) are applied after the standard
parsing has
already happened, and object's are not allowed because they are
just too
risky. So if you want to do that, subclass the WHITELIST
INITIALIZATION
METHODS and add the relevant config in there.
already doing that...
those are placed in object AND embed tags (i don't recall if embed
are off by default)
regardless, it might make sense to mention them in the docs as
they're in a grey-area and something to be wary of when enabling
objects.
allowScriptAccess locks the flashplayer down- it can't call any js
functions or do any document writes/etc. without it, its possible to
have a .swf file that onload starts rewriting the page to load in
external js files and then write them into the document body (thereby
avoiding any js xss safeguards). thats how a lot of old 'skinning'
and 'tracking' was done - people would write mini-apps hiddin in a
1x1 swf file that would manipulate the dom and do whatever data
exchange is needed. it can be pretty insidious.
allowNetworking, i think, disables what getURL can do. i could be
wrong on that one, but i believe that is the command that locks down
what swf files can redirect browsers to ( same domain as html or any
or none )
// Jonathan Vanasco
| - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- - - - - - - - - - - - - - - - - - -
| CEO/Founder SyndiClick Networks
| - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- - - - - - - - - - - - - - - - - - -
| Founder/CTO/CVO
| FindMeOn.com - The cure for Multiple Web Personality Disorder
| Web Identity Management and 3D Social Networking
| - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- - - - - - - - - - - - - - - - - - -
| RoadSound.com - Tools For Bands, Stuff For Fans
| Collaborative Online Management And Syndication Tools
| - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
- - - - - - - - - - - - - - - - - - -
